kadm5.acl rights for foreign principals

[Douglas E. Engert]

Nicolas Williams wrote:
> 
> On Tue, Mar 12, 2002 at 02:25:38PM -0500, Ken Hornstein wrote:
> > >Since we have a multi-realm KDC and in real life the same
> > >people will manage those realms, I'd like to give permissions
> > >to the same principal and if possible I wouldn't like
> > >create user/admin at REALM1, user/admin at REALM2. I just want to
> > >insert a entry for user/admin at REALM1 in kadm5.acl file
> > >for each domain.
> >
> > Unfortunately ... because kadmin/admin is set to only allow AS_REQ based
> > requests (which you don't want to change, trust me) and there's no way
> > to do cross-realm without a TGS-based request, then you're stuck.  You can't
> > do what you want.
> 
> If only GSS-API had a concept of "initial" credentials so that acceptors
> could request initial credentials. But that would necessitate a
> gss_acquire_cred() API that could handle user prompting.
> 

Actuall I am glad it does not have this. Makes it to easy for applications
to start asking for passwords. To easy to make a Trojan horse. 
> Sigh.
> 
> > --Ken
> 
> Cheers,
> 
> Nico
> --
> -DISCLAIMER: an automatically appended disclaimer may follow. By posting-
> -to a public e-mail mailing list I hereby grant permission to distribute-
> -and copy this message.-
> 
> Visit our website at http://www.ubswarburg.com
> 
> This message contains confidential information and is intended only
> for the individual named.  If you are not the named addressee you
> should not disseminate, distribute or copy this e-mail.  Please
> notify the sender immediately by e-mail if you have received this
> e-mail by mistake and delete this e-mail from your system.
> 
> E-mail transmission cannot be guaranteed to be secure or error-free
> as information could be intercepted, corrupted, lost, destroyed,
> arrive late or incomplete, or contain viruses.  The sender therefore
> does not accept liability for any errors or omissions in the contents
> of this message which arise as a result of e-mail transmission.  If
> verification is required please request a hard-copy version.  This
> message is provided for informational purposes and should not be
> construed as a solicitation or offer to buy or sell any securities or
> related financial instruments.
> 
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> http://mailman.mit.edu/mailman/listinfo/kerberos

-- 

 Douglas E. Engert  <DEEngert at anl.gov>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444